ofw-mcp 2.16.2 → 2.16.3

package/dist/bundle.js

@@ -9444,7 +9444,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes2, createHash: createHash2 } = __require("crypto");
+    var { randomBytes: randomBytes3, createHash: createHash2 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -9982,7 +9982,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes2(16).toString("base64");
+      const key = randomBytes3(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -17513,12 +17513,12 @@ var $ZodE164 = /* @__PURE__ */ $constructor("$ZodE164", (inst, def) => {
   $ZodStringFormat.init(inst, def);
 });
 var CC_SANITIZE = /[- ]/g;
-function isLuhnAlgo(digits) {
-  let length = digits.length;
+function isLuhnAlgo(digits2) {
+  let length = digits2.length;
   let bit = 1;
   let sum = 0;
   while (length) {
-    const value = digits.charCodeAt(--length) - 48;
+    const value = digits2.charCodeAt(--length) - 48;
     bit ^= 1;
     sum += bit ? [0, 2, 4, 6, 8, 1, 3, 5, 7, 9][value] : value;
   }
@@ -32880,8 +32880,8 @@ function hex2(_params) {
   return _stringFormat(ZodCustomStringFormat, "hex", regexes_exports.hex, _params);
 }
 function hash(alg, params) {
-  const enc4 = params?.enc ?? "hex";
-  const format = `${alg}_${enc4}`;
+  const enc6 = params?.enc ?? "hex";
+  const format = `${alg}_${enc6}`;
   const regex = regexes_exports[format];
   if (!regex)
     throw new Error(`Unrecognized hash format: ${format}`);
@@ -40837,16 +40837,193 @@ var TokenManager = class {
 import { dirname as dirname2, join as join5 } from "path";
 import { fileURLToPath } from "url";
 
+// node_modules/@fetchproxy/protocol/dist/crypto.js
+var subtle = globalThis.crypto.subtle;
+async function exportRaw(key, format) {
+  const buf = await subtle.exportKey(format, key);
+  return new Uint8Array(buf);
+}
+async function generateX25519() {
+  const kp = await subtle.generateKey({ name: "X25519" }, true, [
+    "deriveBits"
+  ]);
+  const priv = await exportRaw(kp.privateKey, "pkcs8");
+  const pub = await exportRaw(kp.publicKey, "raw");
+  return { privateKey: priv.slice(-32), publicKey: pub };
+}
+async function generateEd25519() {
+  const kp = await subtle.generateKey({ name: "Ed25519" }, true, [
+    "sign",
+    "verify"
+  ]);
+  const priv = await exportRaw(kp.privateKey, "pkcs8");
+  const pub = await exportRaw(kp.publicKey, "raw");
+  return { privateKey: priv.slice(-32), publicKey: pub };
+}
+async function importX25519Priv(raw) {
+  const prefix = new Uint8Array([
+    48,
+    46,
+    2,
+    1,
+    0,
+    48,
+    5,
+    6,
+    3,
+    43,
+    101,
+    110,
+    4,
+    34,
+    4,
+    32
+  ]);
+  const pkcs8 = new Uint8Array(prefix.length + raw.length);
+  pkcs8.set(prefix, 0);
+  pkcs8.set(raw, prefix.length);
+  return subtle.importKey("pkcs8", pkcs8, { name: "X25519" }, false, [
+    "deriveBits"
+  ]);
+}
+async function importX25519Pub(raw) {
+  return subtle.importKey("raw", raw, { name: "X25519" }, false, []);
+}
+async function importEd25519Priv(raw) {
+  const prefix = new Uint8Array([
+    48,
+    46,
+    2,
+    1,
+    0,
+    48,
+    5,
+    6,
+    3,
+    43,
+    101,
+    112,
+    4,
+    34,
+    4,
+    32
+  ]);
+  const pkcs8 = new Uint8Array(prefix.length + raw.length);
+  pkcs8.set(prefix, 0);
+  pkcs8.set(raw, prefix.length);
+  return subtle.importKey("pkcs8", pkcs8, { name: "Ed25519" }, false, ["sign"]);
+}
+async function importEd25519Pub(raw) {
+  return subtle.importKey("raw", raw, { name: "Ed25519" }, false, ["verify"]);
+}
+async function ecdhX25519(privRaw, pubRaw) {
+  const priv = await importX25519Priv(privRaw);
+  const pub = await importX25519Pub(pubRaw);
+  const bits = await subtle.deriveBits({ name: "X25519", public: pub }, priv, 256);
+  return new Uint8Array(bits);
+}
+async function ed25519Sign(privRaw, msg) {
+  const priv = await importEd25519Priv(privRaw);
+  const sig = await subtle.sign({ name: "Ed25519" }, priv, msg);
+  return new Uint8Array(sig);
+}
+async function ed25519Verify(pubRaw, msg, sig) {
+  const pub = await importEd25519Pub(pubRaw);
+  return subtle.verify({ name: "Ed25519" }, pub, sig, msg);
+}
+async function hkdfSha256(ikm, salt, info, lenBytes) {
+  const baseKey = await subtle.importKey("raw", ikm, { name: "HKDF" }, false, [
+    "deriveBits"
+  ]);
+  const bits = await subtle.deriveBits({
+    name: "HKDF",
+    hash: "SHA-256",
+    salt,
+    info
+  }, baseKey, lenBytes * 8);
+  return new Uint8Array(bits);
+}
+async function aesGcmSeal(key, iv, plaintext, aad) {
+  const k = await subtle.importKey("raw", key, { name: "AES-GCM" }, false, [
+    "encrypt"
+  ]);
+  const ct = await subtle.encrypt({ name: "AES-GCM", iv, additionalData: aad }, k, plaintext);
+  return new Uint8Array(ct);
+}
+async function aesGcmOpen(key, iv, ciphertext, aad) {
+  const k = await subtle.importKey("raw", key, { name: "AES-GCM" }, false, [
+    "decrypt"
+  ]);
+  const pt = await subtle.decrypt({ name: "AES-GCM", iv, additionalData: aad }, k, ciphertext);
+  return new Uint8Array(pt);
+}
+async function sha256(data) {
+  const h = await subtle.digest("SHA-256", data);
+  return new Uint8Array(h);
+}
+
+// node_modules/@fetchproxy/protocol/dist/encoding.js
+function toB64(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i++)
+    s += String.fromCharCode(bytes[i]);
+  return btoa(s);
+}
+function fromB64(s) {
+  const bin = atob(s);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++)
+    out[i] = bin.charCodeAt(i);
+  return out;
+}
+
 // node_modules/@fetchproxy/protocol/dist/frames.js
-var PROTOCOL_VERSION = 3;
-var HKDF_SESSION_INFO = "fetchproxy/1.0.0/session";
-function readySignaturePayload(mcpHelloNonce, extHelloNonce, extensionSessionPub) {
-  const out = new Uint8Array(mcpHelloNonce.length + extHelloNonce.length + extensionSessionPub.length);
+var PROTOCOL_VERSION = 4;
+var HKDF_SESSION_INFO = "fetchproxy/4.0.0/session";
+var enc = new TextEncoder();
+function helloSignaturePayload(mcpId, sessionNonce, sessionPub, answersExtNonce) {
+  const id = enc.encode(mcpId);
+  const out = new Uint8Array(id.length + sessionNonce.length + sessionPub.length + answersExtNonce.length);
+  out.set(id, 0);
+  out.set(sessionNonce, id.length);
+  out.set(sessionPub, id.length + sessionNonce.length);
+  out.set(answersExtNonce, id.length + sessionNonce.length + sessionPub.length);
+  return out;
+}
+var ANSWERS_NO_EXT_SESSION = new Uint8Array(32);
+function answersNoExtSession(answersExtNonce) {
+  let bytes;
+  try {
+    bytes = fromB64(answersExtNonce);
+  } catch {
+    return false;
+  }
+  if (bytes.length !== ANSWERS_NO_EXT_SESSION.length)
+    return false;
+  for (const b of bytes)
+    if (b !== 0)
+      return false;
+  return true;
+}
+function readySignaturePayload(mcpHelloNonce, extHelloNonce, extensionSessionPub, mcpSessionPub) {
+  const out = new Uint8Array(mcpHelloNonce.length + extHelloNonce.length + extensionSessionPub.length + mcpSessionPub.length);
   out.set(mcpHelloNonce, 0);
   out.set(extHelloNonce, mcpHelloNonce.length);
   out.set(extensionSessionPub, mcpHelloNonce.length + extHelloNonce.length);
+  out.set(mcpSessionPub, mcpHelloNonce.length + extHelloNonce.length + extensionSessionPub.length);
   return out;
 }
+async function transcriptHash(mcpNonce, extNonce, mcpSessionPub, extSessionPub) {
+  const out = new Uint8Array(mcpNonce.length + extNonce.length + mcpSessionPub.length + extSessionPub.length);
+  out.set(mcpNonce, 0);
+  out.set(extNonce, mcpNonce.length);
+  out.set(mcpSessionPub, mcpNonce.length + extNonce.length);
+  out.set(extSessionPub, mcpNonce.length + extNonce.length + mcpSessionPub.length);
+  return sha256(out);
+}
+function frameAad(mcpId, seq, direction) {
+  return enc.encode(`fetchproxy/4/frame\0${mcpId}\0${seq}\0${direction}`);
+}
 var KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
   "fetch",
   "fetch_in_page",
@@ -40917,6 +41094,138 @@ function isValidJsonPointer(pointer) {
   return true;
 }
 
+// node_modules/@fetchproxy/protocol/dist/public-suffix.js
+var CCTLD_ADMIN_LABELS = /* @__PURE__ */ new Set([
+  "ac",
+  "co",
+  "com",
+  "edu",
+  "gob",
+  "gov",
+  "mil",
+  "net",
+  "nom",
+  "org",
+  "sch"
+]);
+var LISTED_PUBLIC_SUFFIXES = /* @__PURE__ */ new Set([
+  // --- ICANN, under ccTLDs, outside CCTLD_ADMIN_LABELS ---
+  "ad.jp",
+  "ed.jp",
+  "gr.jp",
+  "lg.jp",
+  "ne.jp",
+  "or.jp",
+  "go.kr",
+  "ne.kr",
+  "or.kr",
+  "pe.kr",
+  "re.kr",
+  "go.id",
+  "my.id",
+  "or.id",
+  "web.id",
+  "go.th",
+  "in.th",
+  "or.th",
+  "me.uk",
+  "ltd.uk",
+  "plc.uk",
+  "nhs.uk",
+  "mod.uk",
+  "police.uk",
+  "parliament.uk",
+  "asn.au",
+  "id.au",
+  "gen.in",
+  "ind.in",
+  "firm.in",
+  "eu.org",
+  // --- Vendor ("private") suffixes: one entry = every customer's site ---
+  "github.io",
+  "githubusercontent.com",
+  "gitlab.io",
+  "bitbucket.io",
+  "pages.dev",
+  "workers.dev",
+  "r2.dev",
+  "trycloudflare.com",
+  "vercel.app",
+  "now.sh",
+  "netlify.app",
+  "netlify.live",
+  "herokuapp.com",
+  "herokussl.com",
+  "appspot.com",
+  "web.app",
+  "firebaseapp.com",
+  "cloudfunctions.net",
+  "blogspot.com",
+  "azurewebsites.net",
+  "azurestaticapps.net",
+  "azureedge.net",
+  "azurecontainer.io",
+  "cloudapp.azure.com",
+  "trafficmanager.net",
+  "s3.amazonaws.com",
+  "compute.amazonaws.com",
+  "compute-1.amazonaws.com",
+  "elasticbeanstalk.com",
+  "cloudfront.net",
+  "awsapprunner.com",
+  "amplifyapp.com",
+  "fly.dev",
+  "onrender.com",
+  "railway.app",
+  "koyeb.app",
+  "deno.dev",
+  "replit.dev",
+  "repl.co",
+  "glitch.me",
+  "surge.sh",
+  "neocities.org",
+  "pythonanywhere.com",
+  "readthedocs.io",
+  "gitbook.io",
+  "myshopify.com",
+  "wixsite.com",
+  "editorx.io",
+  "webflow.io",
+  "bubbleapps.io",
+  "notion.site",
+  "framer.app",
+  "framer.website",
+  "ngrok.io",
+  "ngrok.app",
+  "ngrok-free.app",
+  "loca.lt",
+  "duckdns.org",
+  "ddns.net",
+  "no-ip.org",
+  "dyndns.org",
+  "hopto.org",
+  "zapto.org"
+]);
+function isPublicSuffix(host) {
+  const normalised = host.trim().toLowerCase().replace(/\.$/, "");
+  if (normalised === "")
+    return false;
+  const labels = normalised.split(".");
+  if (labels.some((l) => l === ""))
+    return false;
+  if (labels.length === 1)
+    return true;
+  if (LISTED_PUBLIC_SUFFIXES.has(normalised))
+    return true;
+  if (labels.length === 2) {
+    const [secondLevel, tld] = labels;
+    if (secondLevel && tld && /^[a-z]{2}$/.test(tld) && CCTLD_ADMIN_LABELS.has(secondLevel)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 // node_modules/@fetchproxy/protocol/dist/validate.js
 var ProtocolError = class extends Error {
   constructor(message) {
@@ -40953,6 +41262,18 @@ function assertBase64(x, label) {
   if (!BASE64_RE.test(x))
     throw new ProtocolError(`${label}: invalid base64`);
 }
+function base64ByteLength(s) {
+  if (s.length % 4 !== 0)
+    return null;
+  const pad2 = s.endsWith("==") ? 2 : s.endsWith("=") ? 1 : 0;
+  return s.length / 4 * 3 - pad2;
+}
+function assertBase64Bytes(x, label, bytes) {
+  assertBase64(x, label);
+  if (base64ByteLength(x) !== bytes) {
+    throw new ProtocolError(`${label}: expected base64 of ${bytes} raw bytes`);
+  }
+}
 function assertBoolean(x, label) {
   if (typeof x !== "boolean") {
     throw new ProtocolError(`${label}: must be boolean`);
@@ -41174,7 +41495,7 @@ function assertIndexedDbScopesArray(value, label) {
     }
   }
 }
-var DOM_SELECTOR_RE = /^[^-]{1,512}$/;
+var DOM_SELECTOR_RE = /^[^\x00-\x1f\x7f]{1,512}$/;
 var DOM_ATTRIBUTE_RE = /^[A-Za-z_:][A-Za-z0-9_:.\-]{0,127}$/;
 var GRAPHQL_OP_NAME_RE = /^[_A-Za-z][_0-9A-Za-z]{0,127}$/;
 function assertDomSelectorsArray(value, label) {
@@ -41285,6 +41606,9 @@ function validateHello(raw) {
       if (!HOSTNAME_RE.test(d)) {
         throw new ProtocolError(`hello.domains: invalid hostname ${JSON.stringify(d)}`);
       }
+      if (isPublicSuffix(d)) {
+        throw new ProtocolError(`hello.domains: ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
+      }
     }
     if (raw.capabilities !== void 0) {
       if (!Array.isArray(raw.capabilities)) {
@@ -41342,6 +41666,8 @@ function validateHello(raw) {
     assertBase64(raw.identityX25519Pub, "hello.identityX25519Pub");
     assertBase64(raw.identityEd25519Pub, "hello.identityEd25519Pub");
     assertBase64(raw.sessionNonce, "hello.sessionNonce");
+    assertBase64Bytes(raw.sessionPub, "hello.sessionPub", 32);
+    assertBase64Bytes(raw.answersExtNonce, "hello.answersExtNonce", 32);
     assertBase64(raw.sessionSig, "hello.sessionSig");
     return raw;
   }
@@ -41359,11 +41685,34 @@ function validateHello(raw) {
   }
   throw new ProtocolError(`hello.role: must be 'server' or 'extension', got ${String(role)}`);
 }
+function peekHelloVersion(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+    return null;
+  const frame = raw;
+  if (frame.type !== "hello")
+    return null;
+  const protocolVersion = frame.protocolVersion;
+  if (typeof protocolVersion !== "number" || !Number.isInteger(protocolVersion))
+    return null;
+  const accepts = [];
+  if (Array.isArray(frame.accepts)) {
+    for (const a of frame.accepts) {
+      if (typeof a === "string")
+        accepts.push(a);
+    }
+  }
+  return {
+    protocolVersion,
+    mcpId: isValidMcpId(frame.mcpId) ? frame.mcpId : null,
+    accepts
+  };
+}
 function validateReady(raw) {
   assertString(raw.mcpId, "ready.mcpId");
   if (!isValidMcpId(raw.mcpId))
     throw new ProtocolError("ready.mcpId: invalid format");
   assertBase64(raw.extensionSessionPub, "ready.extensionSessionPub");
+  assertBase64Bytes(raw.mcpSessionPub, "ready.mcpSessionPub", 32);
   assertBase64(raw.sessionSig, "ready.sessionSig");
   return raw;
 }
@@ -41376,14 +41725,14 @@ function validateEncrypted(raw) {
   assertBase64(raw.ciphertext, "frame.ciphertext");
   return raw;
 }
-var PAIR_CODE_RE = /^\d{3}-\d{3}$/;
+var PAIR_CODE_RE = /^\d{4}-\d{4}$/;
 function validatePairPending(raw) {
   assertString(raw.mcpId, "pair-pending.mcpId");
   if (!isValidMcpId(raw.mcpId))
     throw new ProtocolError("pair-pending.mcpId: invalid format");
   assertString(raw.pairCode, "pair-pending.pairCode");
   if (!PAIR_CODE_RE.test(raw.pairCode)) {
-    throw new ProtocolError(`pair-pending.pairCode: must match XXX-XXX, got ${String(raw.pairCode)}`);
+    throw new ProtocolError(`pair-pending.pairCode: must match XXXX-XXXX, got ${String(raw.pairCode)}`);
   }
   return { type: "pair-pending", mcpId: raw.mcpId, pairCode: raw.pairCode };
 }
@@ -41831,180 +42180,59 @@ function validateInnerResponse(raw) {
   throw new ProtocolError(`inner.ok: must be boolean, got ${typeof raw.ok}`);
 }
 
-// node_modules/@fetchproxy/protocol/dist/crypto.js
-var subtle = globalThis.crypto.subtle;
-async function exportRaw(key, format) {
-  const buf = await subtle.exportKey(format, key);
-  return new Uint8Array(buf);
-}
-async function generateX25519() {
-  const kp = await subtle.generateKey({ name: "X25519" }, true, [
-    "deriveBits"
-  ]);
-  const priv = await exportRaw(kp.privateKey, "pkcs8");
-  const pub = await exportRaw(kp.publicKey, "raw");
-  return { privateKey: priv.slice(-32), publicKey: pub };
-}
-async function generateEd25519() {
-  const kp = await subtle.generateKey({ name: "Ed25519" }, true, [
-    "sign",
-    "verify"
-  ]);
-  const priv = await exportRaw(kp.privateKey, "pkcs8");
-  const pub = await exportRaw(kp.publicKey, "raw");
-  return { privateKey: priv.slice(-32), publicKey: pub };
-}
-async function importX25519Priv(raw) {
-  const prefix = new Uint8Array([
-    48,
-    46,
-    2,
-    1,
-    0,
-    48,
-    5,
-    6,
-    3,
-    43,
-    101,
-    110,
-    4,
-    34,
-    4,
-    32
-  ]);
-  const pkcs8 = new Uint8Array(prefix.length + raw.length);
-  pkcs8.set(prefix, 0);
-  pkcs8.set(raw, prefix.length);
-  return subtle.importKey("pkcs8", pkcs8, { name: "X25519" }, false, [
-    "deriveBits"
-  ]);
-}
-async function importX25519Pub(raw) {
-  return subtle.importKey("raw", raw, { name: "X25519" }, false, []);
-}
-async function importEd25519Priv(raw) {
-  const prefix = new Uint8Array([
-    48,
-    46,
-    2,
-    1,
-    0,
-    48,
-    5,
-    6,
-    3,
-    43,
-    101,
-    112,
-    4,
-    34,
-    4,
-    32
-  ]);
-  const pkcs8 = new Uint8Array(prefix.length + raw.length);
-  pkcs8.set(prefix, 0);
-  pkcs8.set(raw, prefix.length);
-  return subtle.importKey("pkcs8", pkcs8, { name: "Ed25519" }, false, ["sign"]);
-}
-async function importEd25519Pub(raw) {
-  return subtle.importKey("raw", raw, { name: "Ed25519" }, false, ["verify"]);
-}
-async function ecdhX25519(privRaw, pubRaw) {
-  const priv = await importX25519Priv(privRaw);
-  const pub = await importX25519Pub(pubRaw);
-  const bits = await subtle.deriveBits({ name: "X25519", public: pub }, priv, 256);
-  return new Uint8Array(bits);
-}
-async function ed25519Sign(privRaw, msg) {
-  const priv = await importEd25519Priv(privRaw);
-  const sig = await subtle.sign({ name: "Ed25519" }, priv, msg);
-  return new Uint8Array(sig);
-}
-async function ed25519Verify(pubRaw, msg, sig) {
-  const pub = await importEd25519Pub(pubRaw);
-  return subtle.verify({ name: "Ed25519" }, pub, sig, msg);
-}
-async function hkdfSha256(ikm, salt, info, lenBytes) {
-  const baseKey = await subtle.importKey("raw", ikm, { name: "HKDF" }, false, [
-    "deriveBits"
-  ]);
-  const bits = await subtle.deriveBits({
-    name: "HKDF",
-    hash: "SHA-256",
-    salt,
-    info
-  }, baseKey, lenBytes * 8);
-  return new Uint8Array(bits);
-}
-async function aesGcmSeal(key, iv, plaintext) {
-  const k = await subtle.importKey("raw", key, { name: "AES-GCM" }, false, [
-    "encrypt"
-  ]);
-  const ct = await subtle.encrypt({ name: "AES-GCM", iv }, k, plaintext);
-  return new Uint8Array(ct);
-}
-async function aesGcmOpen(key, iv, ciphertext) {
-  const k = await subtle.importKey("raw", key, { name: "AES-GCM" }, false, [
-    "decrypt"
-  ]);
-  const pt = await subtle.decrypt({ name: "AES-GCM", iv }, k, ciphertext);
-  return new Uint8Array(pt);
-}
-async function sha256(data) {
-  const h = await subtle.digest("SHA-256", data);
-  return new Uint8Array(h);
-}
-
-// node_modules/@fetchproxy/protocol/dist/encoding.js
-function toB64(bytes) {
-  let s = "";
-  for (let i = 0; i < bytes.length; i++)
-    s += String.fromCharCode(bytes[i]);
-  return btoa(s);
-}
-function fromB64(s) {
-  const bin = atob(s);
-  const out = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++)
-    out[i] = bin.charCodeAt(i);
-  return out;
-}
-function concatBytes(a, b) {
-  const out = new Uint8Array(a.length + b.length);
-  out.set(a, 0);
-  out.set(b, a.length);
-  return out;
-}
-
 // node_modules/@fetchproxy/protocol/dist/pair-code.js
-async function derivePairCode(pub) {
-  const h = await sha256(pub);
-  const b0 = h[0] ?? 0;
-  const b1 = h[1] ?? 0;
-  const b2 = h[2] ?? 0;
-  const b3 = h[3] ?? 0;
-  const u32 = (b0 << 24 | b1 << 16 | b2 << 8 | b3) >>> 0;
-  const n = u32 % 1e6;
-  const s = n.toString().padStart(6, "0");
-  return `${s.slice(0, 3)}-${s.slice(3)}`;
+var enc2 = new TextEncoder();
+var PAIR_LABEL = "fetchproxy/4/pair";
+async function pairTranscript(mcpIdentityPub, extIdentityPub, mcpNonce, extNonce, mcpSessionPub) {
+  const label = enc2.encode(PAIR_LABEL);
+  const parts = [mcpIdentityPub, extIdentityPub, mcpNonce, extNonce, mcpSessionPub];
+  const out = new Uint8Array(label.length + 1 + parts.reduce((n, p) => n + p.length, 0));
+  out.set(label, 0);
+  out[label.length] = 0;
+  let at = label.length + 1;
+  for (const p of parts) {
+    out.set(p, at);
+    at += p.length;
+  }
+  return digits(await sha256(out));
 }
-async function derivePairCodeFromIds(mcpPub, extPub) {
-  return derivePairCode(concatBytes(mcpPub, extPub));
+function digits(hash2) {
+  let n = 0n;
+  for (let i = 0; i < 8; i++)
+    n = n << 8n | BigInt(hash2[i] ?? 0);
+  const s = (n % 100000000n).toString().padStart(8, "0");
+  return `${s.slice(0, 4)}-${s.slice(4)}`;
 }
 
 // node_modules/@fetchproxy/protocol/dist/seal.js
-var enc = new TextEncoder();
+var enc3 = new TextEncoder();
 var dec = new TextDecoder();
 function randomIv() {
   const iv = new Uint8Array(12);
   globalThis.crypto.getRandomValues(iv);
   return iv;
 }
-async function sealInnerFrame(sessionKey, mcpId, seq, inner) {
+var AES_GCM_TAG_BYTES = 16;
+var IV_B64_BYTES = 16;
+function base64Length(byteLength) {
+  return Math.ceil(byteLength / 3) * 4;
+}
+function encodeInnerFrame(inner) {
+  return enc3.encode(JSON.stringify(inner));
+}
+function plaintextOf(inner) {
+  return inner instanceof Uint8Array ? inner : encodeInnerFrame(inner);
+}
+function sealedFrameWireBytes(mcpId, seq, inner) {
+  const plaintext = plaintextOf(inner).length;
+  const envelope = enc3.encode(JSON.stringify({ type: "frame", mcpId, seq, iv: "", ciphertext: "" })).length;
+  return envelope + IV_B64_BYTES + base64Length(plaintext + AES_GCM_TAG_BYTES);
+}
+var MAX_FRAME_BYTES = 42 * 1024 * 1024;
+async function sealInnerFrame(sessionKey, mcpId, seq, inner, direction) {
   const iv = randomIv();
-  const pt = enc.encode(JSON.stringify(inner));
-  const ct = await aesGcmSeal(sessionKey, iv, pt);
+  const pt = plaintextOf(inner);
+  const ct = await aesGcmSeal(sessionKey, iv, pt, frameAad(mcpId, seq, direction));
   return {
     type: "frame",
     mcpId,
@@ -42013,18 +42241,18 @@ async function sealInnerFrame(sessionKey, mcpId, seq, inner) {
     ciphertext: toB64(ct)
   };
 }
-async function openEncryptedFrame(sessionKey, frame) {
-  const result = await openEncryptedFrameDetailed(sessionKey, frame);
+async function openEncryptedFrame(sessionKey, frame, direction) {
+  const result = await openEncryptedFrameDetailed(sessionKey, frame, direction);
   if (result.stage === "ok")
     return result.inner;
   throw result.error instanceof Error ? result.error : new Error(String(result.error));
 }
-async function openEncryptedFrameDetailed(sessionKey, frame) {
+async function openEncryptedFrameDetailed(sessionKey, frame, direction) {
   let pt;
   try {
     const iv = fromB64(frame.iv);
     const ct = fromB64(frame.ciphertext);
-    pt = await aesGcmOpen(sessionKey, iv, ct);
+    pt = await aesGcmOpen(sessionKey, iv, ct, frameAad(frame.mcpId, frame.seq, direction));
   } catch (error62) {
     return { stage: "decrypt-failed", error: error62 };
   }
@@ -42108,7 +42336,7 @@ var import_websocket_server = __toESM(require_websocket_server(), 1);
 async function buildServerHello(opts) {
   const sessionNonce = new Uint8Array(32);
   globalThis.crypto.getRandomValues(sessionNonce);
-  const sig = await ed25519Sign(opts.identity.ed25519Priv, concatBytes(new TextEncoder().encode(opts.mcpId), sessionNonce));
+  const sig = await ed25519Sign(opts.identity.ed25519Priv, helloSignaturePayload(opts.mcpId, sessionNonce, opts.sessionPub, opts.answersExtNonce));
   const hello = {
     type: "hello",
     protocolVersion: PROTOCOL_VERSION,
@@ -42121,6 +42349,8 @@ async function buildServerHello(opts) {
     identityX25519Pub: toB64(opts.identity.x25519Pub),
     identityEd25519Pub: toB64(opts.identity.ed25519Pub),
     sessionNonce: toB64(sessionNonce),
+    sessionPub: toB64(opts.sessionPub),
+    answersExtNonce: toB64(opts.answersExtNonce),
     sessionSig: toB64(sig)
   };
   if (opts.accepts && opts.accepts.length > 0)
@@ -42177,23 +42407,91 @@ async function buildServerHello(opts) {
   return hello;
 }
 
+// node_modules/@fetchproxy/server/dist/frame-size.js
+function encodeOutboundInnerFrame(mcpId, inner) {
+  const plaintext = encodeInnerFrame(inner);
+  const wireBytes = sealedFrameWireBytes(mcpId, Number.MAX_SAFE_INTEGER, plaintext);
+  if (wireBytes > MAX_FRAME_BYTES) {
+    throw new Error(`fetchproxy: this request is too large for one bridge frame: ${wireBytes} bytes on the wire, cap ${MAX_FRAME_BYTES}. The request is refused; the bridge is not closed, so other calls and other MCPs on it are unaffected.`);
+  }
+  return plaintext;
+}
+
 // node_modules/@fetchproxy/server/dist/session.js
+var MAX_INFLIGHT_INBOUND_SEQS = 1024;
 var SessionState = class {
   sessionKey;
   outboundSeq = 0;
   lastInboundSeq = 0;
+  inflightInbound = /* @__PURE__ */ new Set();
+  saturationWarned = false;
   constructor(sessionKey) {
     this.sessionKey = sessionKey;
   }
+  /**
+   * Whether the caller holding this claim verdict should log saturation now.
+   * True only on the TRANSITION into it: a line per dropped frame turned a
+   * flood — or a set that never drains — into a log flood amplifying the very
+   * condition it reported (#376). An `'ok'` claim re-arms the latch, since it
+   * is the one signal every caller sees that the set has drained below the
+   * bound; a replay needs no capacity and leaves it alone. Latched per
+   * session, so a renegotiated one starts armed. A set hovering at the bound
+   * can still alternate ok/saturated, but that logs at the rate frames finish
+   * opening, not the rate they arrive.
+   */
+  saturationWarningDue(claim2) {
+    if (claim2 === "ok")
+      this.saturationWarned = false;
+    if (claim2 !== "saturated" || this.saturationWarned)
+      return false;
+    this.saturationWarned = true;
+    return true;
+  }
   nextOutboundSeq() {
     this.outboundSeq += 1;
     return this.outboundSeq;
   }
-  acceptInboundSeq(seq) {
+  /**
+   * Take this seq out of circulation for the frame about to be opened, and
+   * say whether it was available. SYNCHRONOUS and single-shot: call it before
+   * the first `await` of the receive path, or a duplicate frame read in the
+   * same pass will be judged against a counter neither frame has moved yet.
+   *
+   * Anything but `'ok'` means "not this frame's to process": `'replay'` for
+   * a spent seq or a duplicate of one still in flight, `'saturated'` when the
+   * in-flight bound is full. Replay is checked first, since refusing a stale
+   * seq needs no capacity. Every `'ok'` MUST be answered by exactly one
+   * {@link commitInboundSeq} or {@link releaseInboundSeq}.
+   */
+  claimInboundSeq(seq) {
     if (seq <= this.lastInboundSeq)
-      return false;
-    this.lastInboundSeq = seq;
-    return true;
+      return "replay";
+    if (this.inflightInbound.has(seq))
+      return "replay";
+    if (this.inflightInbound.size >= MAX_INFLIGHT_INBOUND_SEQS)
+      return "saturated";
+    this.inflightInbound.add(seq);
+    return "ok";
+  }
+  /**
+   * Give a claim back without spending the seq — for a frame that did not
+   * authenticate, which is a frame that never happened. The counter does not
+   * move, so the genuine frames behind it, carrying lower numbers, are still
+   * accepted. Idempotent, so a caller may release in a `catch` after a commit
+   * it is not sure ran.
+   */
+  releaseInboundSeq(seq) {
+    this.inflightInbound.delete(seq);
+  }
+  /**
+   * Record a seq as spent. Call only for a frame that authenticated. Never
+   * moves the counter backwards, so an out-of-order commit cannot reopen a
+   * seq an earlier one already closed.
+   */
+  commitInboundSeq(seq) {
+    this.inflightInbound.delete(seq);
+    if (seq > this.lastInboundSeq)
+      this.lastInboundSeq = seq;
   }
 };
 
@@ -42227,6 +42525,27 @@ var FetchproxyHelloRejectedError = class extends Error {
     Object.setPrototypeOf(this, new.target.prototype);
   }
 };
+var MIN_VERSION = "3.0.0";
+var FetchproxyProtocolVersionError = class extends Error {
+  /** The protocol version this process speaks. */
+  ourVersion;
+  /** The protocol version the far end announced in the hello we refused. */
+  theirVersion;
+  peer;
+  constructor(info) {
+    const far = info.peer === "extension" ? `the attached browser extension speaks ${info.theirVersion} \u2014 update Transporter (the fetchproxy extension) to ${MIN_VERSION} or later` : `the MCP holding the bridge port speaks ${info.theirVersion} \u2014 upgrade @fetchproxy/server to ${MIN_VERSION} or later in that MCP`;
+    super(`protocol version mismatch: this MCP speaks fetchproxy protocol ${info.ourVersion}, ${far}`);
+    this.name = "FetchproxyProtocolVersionError";
+    this.ourVersion = info.ourVersion;
+    this.theirVersion = info.theirVersion;
+    this.peer = info.peer;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+function protocolVersionCloseReason(info) {
+  const far = info.peer === "extension" ? "the extension" : "the other MCP";
+  return `protocol version mismatch: this MCP speaks ${info.ourVersion}, ${far} speaks ${info.theirVersion}`;
+}
 async function awaitSessionReady(ready, opts) {
   const ms = opts.timeoutMs ?? SESSION_READY_TIMEOUT_MS;
   if (ms <= 0)
@@ -42247,11 +42566,12 @@ async function awaitSessionReady(ready, opts) {
 }
 
 // node_modules/@fetchproxy/server/dist/extension-trust.js
-import { readFile as readFile2, writeFile as writeFile2, rename, unlink, mkdir as mkdir2, chmod as chmod2 } from "node:fs/promises";
-import { join as join4 } from "node:path";
+import { readFile as readFile2, writeFile as writeFile2, rename as rename2, unlink as unlink2, mkdir as mkdir2, chmod as chmod2 } from "node:fs/promises";
+import { isAbsolute as isAbsolute3, join as join4 } from "node:path";
 
 // node_modules/@fetchproxy/server/dist/identity.js
-import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
+import { readFile, readdir, writeFile, mkdir, chmod, rename, rm, unlink } from "node:fs/promises";
+import { randomBytes as randomBytes2 } from "node:crypto";
 import { isAbsolute as isAbsolute2, join as join3 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 var SAFE_PLAIN = /^[A-Za-z0-9._-]+$/;
@@ -42307,16 +42627,46 @@ function parseIdentity(text) {
     createdAt: j.createdAt
   };
 }
+async function openIdentityDir(dir) {
+  await mkdir(dir, { recursive: true, mode: 448 });
+  try {
+    await chmod(dir, 448);
+  } catch (e) {
+    const code = e.code;
+    if (code !== "EROFS" && code !== "EPERM")
+      throw e;
+  }
+}
+var STAGING_BYTES = 6;
+async function sweepStagingFiles(dir, serverName) {
+  const base = safeIdentityFileBase(serverName).replace(/[.]/g, "\\.");
+  const staging = new RegExp(`^${base}\\.json\\.[0-9a-f]{${STAGING_BYTES * 2}}\\.tmp$`);
+  let names;
+  try {
+    names = await readdir(dir);
+  } catch {
+    return;
+  }
+  await Promise.all(names.filter((name) => staging.test(name)).map((name) => unlink(join3(dir, name)).catch(() => void 0)));
+}
 async function writeIdentityFile(dir, serverName, id) {
   const path = identityFilePath(dir, serverName);
-  await mkdir(dir, { recursive: true, mode: 448 });
-  await writeFile(path, serializeIdentity(id), { mode: 384 });
-  await chmod(path, 384);
+  await openIdentityDir(dir);
+  await sweepStagingFiles(dir, serverName);
+  const tmp = `${path}.${randomBytes2(STAGING_BYTES).toString("hex")}.tmp`;
+  try {
+    await writeFile(tmp, serializeIdentity(id), { mode: 384, flag: "wx" });
+    await chmod(tmp, 384);
+    await rename(tmp, path);
+  } catch (e) {
+    await rm(tmp, { force: true });
+    throw e;
+  }
   return path;
 }
 async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
   const path = identityFilePath(dir, serverName);
-  await mkdir(dir, { recursive: true, mode: 448 });
+  await openIdentityDir(dir);
   try {
     return parseIdentity(await readFile(path, "utf8"));
   } catch (e) {
@@ -42329,12 +42679,32 @@ async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
 }
 
 // node_modules/@fetchproxy/server/dist/extension-trust.js
+var TRUST_DIR_ENV = "FETCHPROXY_TRUST_DIR";
+function envTrustDir(env = process.env) {
+  const raw = env[TRUST_DIR_ENV];
+  if (raw === void 0)
+    return void 0;
+  const dir = raw.trim();
+  if (dir !== "" && isAbsolute3(dir))
+    return dir;
+  console.warn(`[fetchproxy] ignoring ${TRUST_DIR_ENV}=${JSON.stringify(raw)}: it is not an absolute path. The extension pin will be written beside the identity instead, which is not where you pointed it \u2014 if that directory is read-only, no pin is ever kept.`);
+  return void 0;
+}
+function resolveTrustDir(explicit, identityDir) {
+  if (explicit !== void 0)
+    return explicit;
+  return envTrustDir() ?? identityDir ?? defaultIdentityDir();
+}
+function defaultTrustDir() {
+  return resolveTrustDir();
+}
 function fileExtensionTrust(args) {
+  const dir = resolveTrustDir(args.trustDir, args.dir);
   return {
     allowNew: args.allowNew,
-    location: extensionTrustPath(args.serverName, args.dir ?? defaultIdentityDir()),
-    read: () => readExtensionPin(args.serverName, args.dir ?? defaultIdentityDir()),
-    write: (pin) => writeExtensionPin(args.serverName, pin, args.dir ?? defaultIdentityDir())
+    location: extensionTrustPath(args.serverName, dir),
+    read: () => readExtensionPin(args.serverName, dir),
+    write: (pin) => writeExtensionPin(args.serverName, pin, dir)
   };
 }
 var TRUST_NEW_EXTENSION_ENV = "FETCHPROXY_TRUST_NEW_EXTENSION";
@@ -42362,14 +42732,14 @@ function decideExtensionTrust(args) {
     message: `[fetchproxy] ${serverName}: refusing an extension whose identity is not the one this MCP paired with. If you re-installed the extension or moved to another browser, re-pair deliberately: run this MCP once with ${TRUST_NEW_EXTENSION_ENV}=1, or delete ${trustPath}. If you did neither, something else is answering as your browser.`
   };
 }
-function extensionTrustPath(serverName, dir = defaultIdentityDir()) {
+function extensionTrustPath(serverName, dir = defaultTrustDir()) {
   return join4(dir, `${safeIdentityFileBase(serverName)}.extension-trust.json`);
 }
 function extensionTrustPathHint(serverName) {
   try {
     return extensionTrustPath(serverName);
   } catch {
-    return join4(defaultIdentityDir(), "<server-name>.extension-trust.json");
+    return join4(defaultTrustDir(), "<server-name>.extension-trust.json");
   }
 }
 function isPin(x) {
@@ -42378,7 +42748,7 @@ function isPin(x) {
   const r = x;
   return typeof r.identityX25519Pub === "string" && typeof r.identityEd25519Pub === "string" && typeof r.pinnedAt === "number";
 }
-async function readExtensionPin(serverName, dir = defaultIdentityDir()) {
+async function readExtensionPin(serverName, dir = defaultTrustDir()) {
   const path = extensionTrustPath(serverName, dir);
   let raw;
   try {
@@ -42403,31 +42773,75 @@ async function readExtensionPin(serverName, dir = defaultIdentityDir()) {
     pinnedAt: parsed.pinnedAt
   };
 }
-async function writeExtensionPin(serverName, pin, dir = defaultIdentityDir()) {
+async function writeExtensionPin(serverName, pin, dir = defaultTrustDir()) {
   const path = extensionTrustPath(serverName, dir);
   await mkdir2(dir, { recursive: true, mode: 448 });
   const tmp = `${path}.tmp`;
   await writeFile2(tmp, JSON.stringify(pin, null, 2), { mode: 384 });
   await chmod2(tmp, 384);
-  await rename(tmp, path);
+  await rename2(tmp, path);
 }
 
 // node_modules/@fetchproxy/server/dist/host.js
-var PUBLIC_ORIGIN_RE = /^https?:\/\/(?!(127\.0\.0\.1|localhost)(:|$))/i;
-var enc2 = new TextEncoder();
+var HTTP_ORIGIN_RE = /^https?:\/\//i;
+var PUBLIC_ORIGIN_RE = /^https?:\/\/(?!(127\.0\.0\.1|localhost|\[::1\])(:|$))/i;
+var EXTENSION_ORIGIN_RE = /^(chrome-extension|moz-extension|safari-web-extension):\/\//i;
+var OPAQUE_ORIGIN = "null";
+var ALLOW_LOCAL_ORIGINS_ENV = "FETCHPROXY_ALLOW_LOCAL_ORIGINS";
+function envAllowsLocalOrigins(env = process.env) {
+  const raw = env[ALLOW_LOCAL_ORIGINS_ENV];
+  if (raw === void 0 || raw.trim() === "")
+    return false;
+  if (raw.trim() === "1")
+    return true;
+  console.warn(`[fetchproxy] ignoring ${ALLOW_LOCAL_ORIGINS_ENV}=${JSON.stringify(raw)}: the only value that turns it on is 1. Upgrades from a null or localhost origin stay refused.`);
+  return false;
+}
+function originVerdict(origin, allowLocal) {
+  if (origin === void 0)
+    return { allow: true };
+  if (HTTP_ORIGIN_RE.test(origin)) {
+    if (PUBLIC_ORIGIN_RE.test(origin)) {
+      return { allow: false, reason: "origin not allowed", escapable: false };
+    }
+    return allowLocal ? { allow: true } : { allow: false, reason: "localhost page origin not allowed", escapable: true };
+  }
+  if (origin.toLowerCase() === OPAQUE_ORIGIN) {
+    return allowLocal ? { allow: true } : { allow: false, reason: "opaque (null) origin not allowed", escapable: true };
+  }
+  if (EXTENSION_ORIGIN_RE.test(origin))
+    return { allow: true };
+  return { allow: false, reason: "origin not allowed", escapable: false };
+}
+var HANDSHAKE_TIMEOUT_MS = 15e3;
+var MAX_PAYLOAD_BYTES = MAX_FRAME_BYTES;
+var enc4 = new TextEncoder();
 async function startHost(opts) {
+  const allowLocalOrigins = envAllowsLocalOrigins();
+  if (allowLocalOrigins) {
+    console.warn(`[fetchproxy] ${ALLOW_LOCAL_ORIGINS_ENV}=1: accepting WebSocket upgrades from null and localhost page origins. This is a development escape \u2014 any local page the browser has open can reach this concentrator while it is set.`);
+  }
+  const warnedOrigins = /* @__PURE__ */ new Set();
   const wss = new import_websocket_server.default({
     server: opts.httpServer,
+    maxPayload: opts.maxPayloadBytes ?? MAX_PAYLOAD_BYTES,
     verifyClient: (info, cb) => {
       const origin = info.req.headers.origin;
-      if (origin && PUBLIC_ORIGIN_RE.test(origin)) {
-        cb(false, 403, "origin not allowed");
+      const verdict = originVerdict(origin, allowLocalOrigins);
+      if (verdict.allow) {
+        cb(true);
         return;
       }
-      cb(true);
+      if (verdict.escapable && origin !== void 0 && warnedOrigins.size < 8) {
+        if (!warnedOrigins.has(origin)) {
+          warnedOrigins.add(origin);
+          console.warn(`[fetchproxy] refused a WebSocket upgrade from ${JSON.stringify(origin)}: ${verdict.reason}. If that is you, developing against the bridge, set ${ALLOW_LOCAL_ORIGINS_ENV}=1 on this MCP \u2014 never on a deployed one.`);
+        }
+      }
+      cb(false, 403, verdict.reason);
     }
   });
-  const ownHello = await buildServerHello({
+  const ownHelloBase = {
     // 2.6.0: tell the extension it can say WHY it refused a hello, instead of
     // leaving us to time out and guess.
     accepts: ["hello-rejected"],
@@ -42446,14 +42860,26 @@ async function startHost(opts) {
     sessionStoragePointers: opts.ownSessionStoragePointers,
     domSelectors: opts.ownDomSelectors,
     graphqlOps: opts.ownGraphqlOps
-  });
-  const ownSessionNonce = fromB64(ownHello.sessionNonce);
+  };
+  const generateSessionKeypair = opts.generateSessionKeypair ?? generateX25519;
   let extensionWs = null;
   const peers = /* @__PURE__ */ new Map();
   const ownInnerListeners = [];
   const disconnectListeners = [];
   const pendingPairListeners = [];
   let ownSession = null;
+  let ownEphemeral = null;
+  function dropOwnSessionAndEphemeral() {
+    if (ownEphemeral)
+      ownEphemeral.priv.fill(0);
+    ownEphemeral = null;
+    return null;
+  }
+  function installOwnEphemeral(next) {
+    if (ownEphemeral)
+      ownEphemeral.priv.fill(0);
+    ownEphemeral = next;
+  }
   let ownPendingPairCode = null;
   let resolveOwnSession;
   let rejectOwnSession;
@@ -42467,21 +42893,74 @@ async function startHost(opts) {
     });
   }
   resetSessionPromise();
+  let ownSessionRefusal = null;
+  function refuseVersionMismatch(ws, raw, identified) {
+    const peek = peekHelloVersion(raw);
+    if (!peek || peek.protocolVersion === PROTOCOL_VERSION)
+      return false;
+    const err = new FetchproxyProtocolVersionError({
+      ourVersion: PROTOCOL_VERSION,
+      theirVersion: peek.protocolVersion,
+      peer: peek.mcpId === null ? "extension" : "mcp"
+    });
+    console.warn(`[fetchproxy] host: ${err.message}`);
+    const nothingBetterAttached = extensionWs === null && extensionClaim === null && ownSession === null;
+    if (err.peer === "extension" && identified !== "peer" && nothingBetterAttached) {
+      ownSessionRefusal = err;
+      rejectOwnSession(err);
+      resetSessionPromise();
+      rejectOwnSession(err);
+    }
+    try {
+      ws.close(1002, protocolVersionCloseReason(err));
+    } catch {
+    }
+    return true;
+  }
   let extensionHello = null;
   let extensionClaim = null;
+  const pairCodeFor = async (hello, mint) => {
+    if (!mint)
+      return null;
+    try {
+      return await pairTranscript(opts.ownIdentity.x25519Pub, fromB64(hello.identityX25519Pub), mint.nonce, fromB64(hello.sessionNonce), mint.pub);
+    } catch (e) {
+      console.error("[fetchproxy] could not derive the pair code:", e);
+      return null;
+    }
+  };
   wss.on("connection", (ws) => {
     let identified = null;
     let peerMcpId = null;
     let closed = false;
     let pinOnReady = false;
+    const handshakeTimer = setTimeout(() => {
+      if (identified || closed)
+        return;
+      try {
+        ws.close(1008, "handshake timeout");
+      } catch {
+      }
+    }, opts.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS);
+    handshakeTimer.unref?.();
+    ws.on("error", (e) => {
+      console.warn(`[fetchproxy] host: socket error: ${String(e)}`);
+    });
     ws.on("message", async (data) => {
       try {
+        let raw;
+        try {
+          raw = JSON.parse(data.toString());
+        } catch {
+          ws.close(1002, "protocol error");
+          return;
+        }
         let frame;
         try {
-          const raw = JSON.parse(data.toString());
           frame = validateFrame(raw);
         } catch {
-          ws.close(1002, "protocol error");
+          if (!refuseVersionMismatch(ws, raw, identified))
+            ws.close(1002, "protocol error");
           return;
         }
         if (frame.type === "hello" && frame.role === "extension") {
@@ -42525,25 +43004,43 @@ async function startHost(opts) {
           identified = "extension";
           extensionWs = ws;
           extensionHello = frame;
-          if (opts.onPairCode) {
+          if (ownSessionRefusal) {
+            ownSessionRefusal = null;
+            resetSessionPromise();
+          }
+          const mintedKeypair = await generateSessionKeypair();
+          const mintedHello = await buildServerHello({
+            ...ownHelloBase,
+            sessionPub: mintedKeypair.publicKey,
+            // The echo Rule B's gate reads, inside the signed payload: this
+            // hello answers the extension session whose hello triggered it.
+            answersExtNonce: fromB64(frame.sessionNonce)
+          });
+          if (extensionWs !== ws) {
+            mintedKeypair.privateKey.fill(0);
+            return;
+          }
+          const mint = {
+            nonce: fromB64(mintedHello.sessionNonce),
+            pub: mintedKeypair.publicKey
+          };
+          installOwnEphemeral({ ...mint, priv: mintedKeypair.privateKey });
+          for (const slot of peers.values())
+            slot.ws.send(JSON.stringify(frame));
+          ws.send(JSON.stringify(mintedHello));
+          const helloPairCode = await pairCodeFor(frame, mint);
+          if (opts.onPairCode && helloPairCode !== null) {
             try {
-              const code = await derivePairCodeFromIds(opts.ownIdentity.x25519Pub, fromB64(frame.identityX25519Pub));
-              opts.onPairCode(code);
+              opts.onPairCode(helloPairCode);
             } catch (e) {
               console.error("[fetchproxy] onPairCode threw:", e);
             }
           }
-          for (const slot of peers.values())
-            slot.ws.send(JSON.stringify(frame));
-          ws.send(JSON.stringify(ownHello));
-          for (const slot of peers.values()) {
-            ws.send(JSON.stringify(slot.helloFrame));
-          }
           return;
         }
         if (frame.type === "hello" && frame.role === "server") {
           const peerEdPub = fromB64(frame.identityEd25519Pub);
-          const peerSigMsg = concatBytes(enc2.encode(frame.mcpId), fromB64(frame.sessionNonce));
+          const peerSigMsg = helloSignaturePayload(frame.mcpId, fromB64(frame.sessionNonce), fromB64(frame.sessionPub), fromB64(frame.answersExtNonce));
           const peerSig = fromB64(frame.sessionSig);
           let peerSigOk = false;
           try {
@@ -42568,10 +43065,12 @@ async function startHost(opts) {
           identified = "peer";
           peerMcpId = frame.mcpId;
           peers.set(frame.mcpId, { ws, helloFrame: frame });
-          if (extensionWs)
-            extensionWs.send(JSON.stringify(frame));
-          if (extensionHello)
+          if (extensionHello && answersNoExtSession(frame.answersExtNonce)) {
             ws.send(JSON.stringify(extensionHello));
+          }
+          if (extensionWs && extensionHello && frame.answersExtNonce === extensionHello.sessionNonce) {
+            extensionWs.send(JSON.stringify(frame));
+          }
           return;
         }
         if (frame.type === "ready") {
@@ -42581,9 +43080,14 @@ async function startHost(opts) {
               ws.close(1002, "ready before extension hello");
               return;
             }
+            const held = ownEphemeral;
+            if (!held || frame.mcpSessionPub !== toB64(held.pub)) {
+              console.warn("[fetchproxy] discarding a ready for a session ephemeral this host no longer holds (the extension reconnected while a hello was in flight)");
+              return;
+            }
             const extEdPub = fromB64(extensionHello.identityEd25519Pub);
             const extNonce = fromB64(extensionHello.sessionNonce);
-            const msg = readySignaturePayload(ownSessionNonce, extNonce, fromB64(frame.extensionSessionPub));
+            const msg = readySignaturePayload(held.nonce, extNonce, fromB64(frame.extensionSessionPub), held.pub);
             const sig = fromB64(frame.sessionSig);
             let sigOk = false;
             try {
@@ -42609,8 +43113,9 @@ async function startHost(opts) {
               }
             }
             const extPub = fromB64(frame.extensionSessionPub);
-            const shared = await ecdhX25519(opts.ownIdentity.x25519Priv, extPub);
-            const key = await hkdfSha256(shared, ownSessionNonce, enc2.encode(HKDF_SESSION_INFO), 32);
+            const shared = await ecdhX25519(held.priv, extPub);
+            const salt = await transcriptHash(held.nonce, extNonce, held.pub, extPub);
+            const key = await hkdfSha256(shared, salt, enc4.encode(HKDF_SESSION_INFO), 32);
             if (extensionWs !== ws)
               return;
             ownSession = new SessionState(key);
@@ -42626,11 +43131,23 @@ async function startHost(opts) {
         if (frame.type === "frame") {
           if (identified === "extension") {
             if (frame.mcpId === opts.ownMcpId) {
-              if (!ownSession)
+              const session = ownSession;
+              if (!session)
                 return;
-              if (!ownSession.acceptInboundSeq(frame.seq))
+              const claim2 = session.claimInboundSeq(frame.seq);
+              if (session.saturationWarningDue(claim2)) {
+                console.warn(`[fetchproxy] ${opts.ownServerName}: dropped an inbound frame (seq ${frame.seq}) unread \u2014 too many frames from the extension are still being opened (inbound claims saturated). Not a replay. Further drops are not logged until the in-flight set drains.`);
+              }
+              if (claim2 !== "ok")
                 return;
-              const inner = await openEncryptedFrame(ownSession.sessionKey, frame);
+              let inner;
+              try {
+                inner = await openEncryptedFrame(session.sessionKey, frame, "e2s");
+              } catch (e) {
+                session.releaseInboundSeq(frame.seq);
+                throw e;
+              }
+              session.commitInboundSeq(frame.seq);
               ownInnerListeners.forEach((cb) => cb(inner));
             } else {
               const slot = peers.get(frame.mcpId);
@@ -42654,8 +43171,16 @@ async function startHost(opts) {
         }
         if (frame.type === "pair-pending" && identified === "extension") {
           if (frame.mcpId === opts.ownMcpId) {
-            ownPendingPairCode = frame.pairCode;
-            pendingPairListeners.forEach((cb) => cb(frame.pairCode));
+            const hello = extensionHello;
+            const mint = ownEphemeral;
+            const derived2 = hello === null ? null : await pairCodeFor(hello, mint);
+            if (derived2 === null || frame.pairCode !== derived2) {
+              console.error(`[fetchproxy] ${opts.ownServerName}: the extension's pair code (${frame.pairCode}) does not match the one this MCP derived from the pair transcript` + (derived2 === null ? " (none \u2014 this MCP could not derive its own)" : ` (${derived2})`) + " \u2014 refusing to pair (possible MITM between this MCP and the extension)");
+              ws.close(1008, "pair code mismatch");
+              return;
+            }
+            ownPendingPairCode = derived2;
+            pendingPairListeners.forEach((cb) => cb(derived2));
           } else {
             const slot = peers.get(frame.mcpId);
             if (slot)
@@ -42672,6 +43197,7 @@ async function startHost(opts) {
     });
     ws.on("close", () => {
       closed = true;
+      clearTimeout(handshakeTimer);
       if (extensionClaim === ws)
         extensionClaim = null;
       if (identified === "extension" && extensionWs === ws) {
@@ -42680,7 +43206,7 @@ async function startHost(opts) {
         if (!ownSession) {
           rejectOwnSession(new Error("extension disconnected before ready"));
         }
-        ownSession = null;
+        ownSession = dropOwnSessionAndEphemeral();
         ownPendingPairCode = null;
         resetSessionPromise();
         disconnectListeners.forEach((cb) => cb());
@@ -42719,7 +43245,8 @@ async function startHost(opts) {
       });
       if (!extensionWs)
         throw new Error("host: no extension connected");
-      const sealed = await sealInnerFrame(session.sessionKey, opts.ownMcpId, session.nextOutboundSeq(), inner);
+      const plaintext = encodeOutboundInnerFrame(opts.ownMcpId, inner);
+      const sealed = await sealInnerFrame(session.sessionKey, opts.ownMcpId, session.nextOutboundSeq(), plaintext, "s2e");
       extensionWs.send(JSON.stringify(sealed));
     },
     onOwnInner: (cb) => {
@@ -42738,14 +43265,32 @@ async function startHost(opts) {
 }
 
 // node_modules/@fetchproxy/server/dist/peer.js
-var enc3 = new TextEncoder();
+var enc5 = new TextEncoder();
 async function startPeer(opts) {
-  const ws = new import_websocket.default(`ws://${opts.host}:${opts.port}`);
+  const ws = new import_websocket.default(`ws://${opts.host}:${opts.port}`, {
+    maxPayload: opts.maxPayloadBytes ?? MAX_PAYLOAD_BYTES
+  });
   await new Promise((resolve3, reject) => {
-    ws.once("open", () => resolve3());
-    ws.once("error", reject);
+    const onOpen = () => {
+      cleanup();
+      resolve3();
+    };
+    const onError = (e) => {
+      cleanup();
+      reject(e);
+    };
+    const cleanup = () => {
+      ws.off("open", onOpen);
+      ws.off("error", onError);
+    };
+    ws.once("open", onOpen);
+    ws.once("error", onError);
   });
-  const hello = await buildServerHello({
+  ws.on("error", (e) => {
+    console.warn(`[fetchproxy] peer: socket error: ${String(e)}`);
+  });
+  const generateSessionKeypair = opts.generateSessionKeypair ?? generateX25519;
+  const helloBase = {
     identity: opts.identity,
     mcpId: opts.mcpId,
     serverName: opts.serverName,
@@ -42765,15 +43310,39 @@ async function startPeer(opts) {
     // `extensionConnected()` / `sessionLinked()` can go back to false.
     // 2.6.0: `hello-rejected` for the same reason, from the extension.
     accepts: ["extension-disconnected", "hello-rejected"]
+  };
+  const bootstrapKeypair = await generateSessionKeypair();
+  let bootstrapPriv = bootstrapKeypair.privateKey;
+  const hello = await buildServerHello({
+    ...helloBase,
+    sessionPub: bootstrapKeypair.publicKey,
+    // At dial this peer has been told of no extension session, and saying so
+    // is what keeps the host from forwarding a hello whose ephemeral is not
+    // one a session may be opened from.
+    answersExtNonce: ANSWERS_NO_EXT_SESSION
   });
-  const sessionNonce = fromB64(hello.sessionNonce);
   ws.send(JSON.stringify(hello));
   const innerListeners = [];
   const renegotiateListeners = [];
   const pendingPairListeners = [];
   const closeListeners = [];
   let session = null;
+  let sessionEphemeral = null;
+  function dropSessionEphemeral() {
+    if (sessionEphemeral)
+      sessionEphemeral.priv.fill(0);
+    sessionEphemeral = null;
+  }
+  function installSessionEphemeral(next) {
+    dropSessionEphemeral();
+    if (bootstrapPriv) {
+      bootstrapPriv.fill(0);
+      bootstrapPriv = null;
+    }
+    sessionEphemeral = next;
+  }
   let pendingPairCode = null;
+  let warnedUnverifiablePairCode = false;
   let resolveFirstReady;
   let rejectFirstReady;
   const sessionPromise = new Promise((resolve3, reject) => {
@@ -42782,58 +43351,60 @@ async function startPeer(opts) {
   });
   let extensionHello = null;
   let extensionGone = false;
-  let warnedUnverifiable = false;
   let cachedPin = void 0;
-  const authenticateExtension = async (sessionSig, extensionSessionPub) => {
-    if (!extensionHello) {
-      if (opts.requireExtensionIdentity) {
-        console.error(`[fetchproxy] ${opts.serverName}: the concentrator does not forward the extension's identity, so this session cannot be verified \u2014 refusing. Upgrade the MCP holding the bridge port to 1.12.0 or later.`);
-        return false;
-      }
-      if (!warnedUnverifiable) {
-        warnedUnverifiable = true;
-        console.warn(`[fetchproxy] ${opts.serverName}: the concentrator does not forward the extension's identity (pre-1.12.0), so this peer cannot verify which browser it is talking to. Upgrade the MCP holding the bridge port to close this.`);
-      }
-      return true;
+  const pairCodeFor = async (hello2, mint) => {
+    if (!mint)
+      return null;
+    try {
+      return await pairTranscript(opts.identity.x25519Pub, fromB64(hello2.identityX25519Pub), mint.nonce, fromB64(hello2.sessionNonce), mint.pub);
+    } catch (e) {
+      console.error("[fetchproxy] could not derive the pair code:", e);
+      return null;
+    }
+  };
+  const authenticateExtension = async (sessionSig, extensionSessionPub, held, hello2) => {
+    if (!hello2) {
+      console.error(`[fetchproxy] ${opts.serverName}: no extension hello has been relayed to this peer, so there is nothing to derive a v4 session from \u2014 refusing. Upgrade the MCP holding the bridge port to 3.0.0 or later.`);
+      return null;
     }
-    const payload = readySignaturePayload(sessionNonce, fromB64(extensionHello.sessionNonce), fromB64(extensionSessionPub));
+    const payload = readySignaturePayload(held.nonce, fromB64(hello2.sessionNonce), fromB64(extensionSessionPub), held.pub);
     let sigOk = false;
     try {
-      sigOk = await ed25519Verify(fromB64(extensionHello.identityEd25519Pub), payload, fromB64(sessionSig));
+      sigOk = await ed25519Verify(fromB64(hello2.identityEd25519Pub), payload, fromB64(sessionSig));
     } catch {
       sigOk = false;
     }
     if (!sigOk) {
       console.warn(`[fetchproxy] ${opts.serverName}: extension session signature invalid \u2014 refusing (the concentrator may be answering in the browser's place)`);
-      return false;
+      return null;
     }
     if (cachedPin === void 0) {
       try {
         cachedPin = await opts.extensionTrust.read();
       } catch (e) {
         console.error(`[fetchproxy] ${String(e)}`);
-        return false;
+        return null;
       }
     }
     const pin = cachedPin;
     const outcome = decideExtensionTrust({
       pin,
-      hello: extensionHello,
+      hello: hello2,
       allowNew: opts.extensionTrust.allowNew,
       serverName: opts.serverName,
       location: opts.extensionTrust.location
     });
     if (outcome.decision === "refused") {
       console.warn(outcome.message);
-      return false;
+      return null;
     }
     if (outcome.decision === "replace")
       console.warn(outcome.message);
     if (outcome.decision !== "pinned") {
       try {
         const written = {
-          identityX25519Pub: extensionHello.identityX25519Pub,
-          identityEd25519Pub: extensionHello.identityEd25519Pub,
+          identityX25519Pub: hello2.identityX25519Pub,
+          identityEd25519Pub: hello2.identityEd25519Pub,
           pinnedAt: Date.now()
         };
         await opts.extensionTrust.write(written);
@@ -42842,32 +43413,62 @@ async function startPeer(opts) {
         console.error(`[fetchproxy] could not persist the extension pin: ${String(e)}`);
       }
     }
-    return true;
+    return hello2;
   };
   const onMessage = async (data) => {
+    let raw;
     try {
-      const raw = JSON.parse(data.toString());
+      raw = JSON.parse(data.toString());
       const frame = validateFrame(raw);
       if (frame.type === "hello" && frame.role === "extension") {
         extensionHello = frame;
+        const mintedKeypair = await generateSessionKeypair();
+        const mintedHello = await buildServerHello({
+          ...helloBase,
+          sessionPub: mintedKeypair.publicKey,
+          answersExtNonce: fromB64(frame.sessionNonce)
+        });
+        if (extensionHello !== frame) {
+          mintedKeypair.privateKey.fill(0);
+          return;
+        }
+        installSessionEphemeral({
+          nonce: fromB64(mintedHello.sessionNonce),
+          pub: mintedKeypair.publicKey,
+          priv: mintedKeypair.privateKey
+        });
+        ws.send(JSON.stringify(mintedHello));
         return;
       }
       if (frame.type === "extension-disconnected") {
         extensionHello = null;
         extensionGone = true;
+        dropSessionEphemeral();
         pendingPairCode = null;
         return;
       }
       if (frame.type === "ready" && frame.mcpId === opts.mcpId) {
-        const authorised = await authenticateExtension(frame.sessionSig, frame.extensionSessionPub);
-        if (!authorised) {
+        const held = sessionEphemeral;
+        const heldExtHello = extensionHello;
+        if (!held || frame.mcpSessionPub !== toB64(held.pub)) {
+          console.warn(`[fetchproxy] ${opts.serverName}: discarding a ready for a session ephemeral this peer no longer holds (the extension reconnected while a hello was in flight)`);
+          return;
+        }
+        const authenticated = await authenticateExtension(frame.sessionSig, frame.extensionSessionPub, held, heldExtHello);
+        if (!authenticated) {
           ws.close(1008, "extension identity refused");
           rejectFirstReady(new Error("peer: extension identity refused"));
           return;
         }
         const extPub = fromB64(frame.extensionSessionPub);
-        const shared = await ecdhX25519(opts.identity.x25519Priv, extPub);
-        const sessionKey = await hkdfSha256(shared, sessionNonce, enc3.encode(HKDF_SESSION_INFO), 32);
+        const extNonce = fromB64(authenticated.sessionNonce);
+        const shared = await ecdhX25519(held.priv, extPub);
+        const salt = await transcriptHash(held.nonce, extNonce, held.pub, extPub);
+        const sessionKey = await hkdfSha256(shared, salt, enc5.encode(HKDF_SESSION_INFO), 32);
+        if (sessionEphemeral !== held) {
+          console.warn(`[fetchproxy] ${opts.serverName}: dropping a session derived against an ephemeral that was superseded while it was being derived`);
+          return;
+        }
         const isRenegotiation = session !== null;
         session = new SessionState(sessionKey);
         extensionGone = false;
@@ -42883,16 +43484,46 @@ async function startPeer(opts) {
         rejectFirstReady(new FetchproxyHelloRejectedError({ mcpId: frame.mcpId, reason: frame.reason }));
       }
       if (frame.type === "pair-pending" && frame.mcpId === opts.mcpId) {
-        pendingPairCode = frame.pairCode;
-        pendingPairListeners.forEach((cb) => cb(frame.pairCode));
+        const hello2 = extensionHello;
+        const mint = sessionEphemeral;
+        const derived2 = hello2 === null ? null : await pairCodeFor(hello2, mint);
+        if (derived2 === null) {
+          if (!warnedUnverifiablePairCode) {
+            warnedUnverifiablePairCode = true;
+            console.warn(`[fetchproxy] ${opts.serverName}: a pair code arrived that this peer cannot derive for itself (no extension identity has been relayed to it, or no session ephemeral has been minted in answer to one), so it is not being shown. If the MCP holding the bridge port is older than 1.12.0, upgrading it closes this.`);
+          }
+          return;
+        }
+        if (frame.pairCode !== derived2) {
+          console.error(`[fetchproxy] ${opts.serverName}: the extension's pair code (${frame.pairCode}) does not match the one this peer derived from the pair transcript (${derived2}) \u2014 refusing to pair (possible MITM between this MCP and the extension)`);
+          ws.close(1008, "pair code mismatch");
+          return;
+        }
+        pendingPairCode = derived2;
+        pendingPairListeners.forEach((cb) => cb(derived2));
         return;
       }
       if (frame.type === "frame" && frame.mcpId === opts.mcpId) {
-        if (!session)
+        const inboundSession = session;
+        if (!inboundSession)
           return;
-        if (!session.acceptInboundSeq(frame.seq))
+        const claim2 = inboundSession.claimInboundSeq(frame.seq);
+        if (inboundSession.saturationWarningDue(claim2)) {
+          console.warn(`[fetchproxy] ${opts.serverName}: dropped an inbound frame (seq ${frame.seq}) unread \u2014 too many frames from the extension are still being opened (inbound claims saturated). Not a replay. Further drops are not logged until the in-flight set drains.`);
+        }
+        if (claim2 !== "ok")
           return;
-        const result = await openEncryptedFrameDetailed(session.sessionKey, frame);
+        let result;
+        try {
+          result = await openEncryptedFrameDetailed(inboundSession.sessionKey, frame, "e2s");
+        } catch (e) {
+          inboundSession.releaseInboundSeq(frame.seq);
+          throw e;
+        }
+        if (result.stage !== "decrypt-failed")
+          inboundSession.commitInboundSeq(frame.seq);
+        else
+          inboundSession.releaseInboundSeq(frame.seq);
         if (result.stage === "ok") {
           innerListeners.forEach((cb) => cb(result.inner));
         } else if (result.stage === "decrypt-failed") {
@@ -42909,12 +43540,25 @@ async function startPeer(opts) {
         }
       }
     } catch (e) {
-      rejectFirstReady(e instanceof Error ? e : new Error(String(e)));
+      const peek = peekHelloVersion(raw);
+      const mismatch = peek && peek.protocolVersion !== PROTOCOL_VERSION ? new FetchproxyProtocolVersionError({
+        ourVersion: PROTOCOL_VERSION,
+        theirVersion: peek.protocolVersion,
+        peer: peek.mcpId === null ? "extension" : "mcp"
+      }) : null;
+      if (mismatch)
+        console.warn(`[fetchproxy] ${opts.serverName}: ${mismatch.message}`);
+      rejectFirstReady(mismatch ?? (e instanceof Error ? e : new Error(String(e))));
     }
   };
   ws.on("message", onMessage);
   ws.once("close", () => {
     rejectFirstReady(new Error("peer WS closed before ready"));
+    dropSessionEphemeral();
+    if (bootstrapPriv) {
+      bootstrapPriv.fill(0);
+      bootstrapPriv = null;
+    }
     closeListeners.forEach((cb) => cb());
   });
   sessionPromise.catch(() => {
@@ -42928,7 +43572,8 @@ async function startPeer(opts) {
         pendingPairCode: () => pendingPairCode
       });
       const s = session;
-      const sealed = await sealInnerFrame(s.sessionKey, opts.mcpId, s.nextOutboundSeq(), inner);
+      const plaintext = encodeOutboundInnerFrame(opts.mcpId, inner);
+      const sealed = await sealInnerFrame(s.sessionKey, opts.mcpId, s.nextOutboundSeq(), plaintext, "s2e");
       ws.send(JSON.stringify(sealed));
     },
     onInner: (cb) => {
@@ -43119,6 +43764,12 @@ function protocolErrorFrom(error62, op) {
     return new FetchproxyNoTabError(error62);
   return new FetchproxyProtocolError(error62);
 }
+var VERB_DEADLINE_GRACE_MS = 15e3;
+function verbDeadlineMs(transportMs, requestedMs, graceMs = VERB_DEADLINE_GRACE_MS) {
+  if (requestedMs === void 0)
+    return transportMs;
+  return Math.max(requestedMs + graceMs, transportMs);
+}
 var FetchproxyTimeoutError = class extends FetchproxyProtocolError {
   url;
   timeoutMs;
@@ -43137,16 +43788,20 @@ var FetchproxyTimeoutError = class extends FetchproxyProtocolError {
    */
   retryAttempted;
   /**
-   * 2.4.2+ (#277): what the CALL asked for, when that is more than the
-   * deadline that actually fired. A per-call `timeoutMs` is forwarded to the
-   * extension but does not raise this server's `fetchTimeoutMs`, so the
-   * shorter deadline wins — and used to report only its own number, a value
-   * the caller never supplied, from an option the message never named.
+   * 2.4.2+ (#277): what the CALL asked for, whenever it asked for anything.
+   *
+   * Until #237 this was recorded only when the call asked for MORE than the
+   * deadline, because asking for more is what the cap silently ignored. The
+   * cap is gone — the call's own `timeoutMs` now GOVERNS its deadline
+   * (`verbDeadlineMs`) — so the interesting case inverted: a timeout here
+   * means the bridge did not answer within the window the CALLER chose, and
+   * the message says which number that was and where it came from.
    */
   requestedTimeoutMs;
   constructor(args) {
-    const capped = args.requestedTimeoutMs !== void 0 && args.requestedTimeoutMs > args.timeoutMs;
-    super(`fetchproxy: ${args.url} did not respond within ${args.timeoutMs}ms` + (capped ? ` \u2014 that is this server's fetchTimeoutMs, not the ${args.requestedTimeoutMs}ms this call asked for. A per-call timeoutMs cannot exceed it; raise fetchTimeoutMs on the transport to wait longer.` : ""));
+    const graceMs = args.graceMs ?? VERB_DEADLINE_GRACE_MS;
+    const callerChose = args.requestedTimeoutMs !== void 0 && args.timeoutMs === args.requestedTimeoutMs + graceMs;
+    super(`fetchproxy: ${args.url} did not respond within ${args.timeoutMs}ms` + (callerChose ? ` \u2014 the ${args.requestedTimeoutMs}ms this call asked for, plus ${graceMs}ms for the reply to reach this server. The extension runs its own timer on the value you passed, so a window that is genuinely too short reports what did not happen rather than this.` : ""));
     this.name = "FetchproxyTimeoutError";
     this.url = args.url;
     this.timeoutMs = args.timeoutMs;
@@ -43279,6 +43934,11 @@ var FetchproxyServer = class {
     if (!Array.isArray(opts.domains) || opts.domains.length === 0) {
       throw new Error("FetchproxyServer: opts.domains must be a non-empty array of hostnames");
     }
+    for (const d of opts.domains) {
+      if (typeof d === "string" && isPublicSuffix(d)) {
+        throw new Error(`FetchproxyServer: opts.domains entry ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
+      }
+    }
     let capabilities;
     if (opts.capabilities === void 0) {
       capabilities = ["fetch"];
@@ -43344,6 +44004,7 @@ var FetchproxyServer = class {
       // back-door is `0` (explicit opt-out) if a caller genuinely wants
       // the legacy hang-forever / fail-once-on-SW-eviction behavior.
       fetchTimeoutMs: opts.fetchTimeoutMs ?? 3e4,
+      verbDeadlineGraceMs: opts.verbDeadlineGraceMs ?? VERB_DEADLINE_GRACE_MS,
       bridgeReviveDelayMs: opts.bridgeReviveDelayMs ?? 2e3,
       // 0.10.0+ (#72): keep-alive defaults to 25s — round-3 #71 cohort
       // wave showed every Pattern A consumer was opting into this same
@@ -43362,6 +44023,7 @@ var FetchproxyServer = class {
       keepAliveIntervalMs: opts.keepAliveIntervalMs ?? 2e4,
       keepAliveMaxIdleMs: opts.keepAliveMaxIdleMs ?? 5 * 60 * 1e3,
       identityDir: opts.identityDir,
+      trustDir: opts.trustDir,
       allowNewExtensionIdentity: opts.allowNewExtensionIdentity,
       requireExtensionIdentity: opts.requireExtensionIdentity,
       onPairCode: opts.onPairCode
@@ -43638,7 +44300,9 @@ var FetchproxyServer = class {
   }
   /**
    * #208: this MCP's pin on the extension's identity, stored beside its own
-   * identity key and so following `identityDir` wherever the caller put it.
+   * identity key and so following `identityDir` wherever the caller put it —
+   * unless `trustDir` (or `FETCHPROXY_TRUST_DIR`) says otherwise, which is
+   * what a host that provisions the identity read-only has to say.
    *
    * `allowNewExtensionIdentity` falls back to an environment variable when the
    * caller expressed no opinion, because the thirteen MCPs that construct this
@@ -43650,6 +44314,7 @@ var FetchproxyServer = class {
     return fileExtensionTrust({
       serverName: this.opts.serverName,
       dir: this.opts.identityDir,
+      trustDir: this.opts.trustDir,
       allowNew: allowNewExtensionIdentity(this.opts.allowNewExtensionIdentity)
     });
   }
@@ -43812,9 +44477,11 @@ var FetchproxyServer = class {
     return pending;
   }
   async _withVerbTimeout(pending, pendingMap, id, url2, requestedTimeoutMs) {
-    const timeoutMs = this.opts.fetchTimeoutMs;
-    if (timeoutMs === void 0 || timeoutMs <= 0)
+    const transportMs = this.opts.fetchTimeoutMs;
+    if (transportMs === void 0 || transportMs <= 0)
       return pending;
+    const graceMs = this.opts.verbDeadlineGraceMs;
+    const timeoutMs = verbDeadlineMs(transportMs, requestedTimeoutMs, graceMs);
     let timer;
     const start = Date.now();
     try {
@@ -43830,6 +44497,7 @@ var FetchproxyServer = class {
               port: this.opts.port,
               elapsedMs: Date.now() - start,
               retryAttempted: false,
+              graceMs,
               ...requestedTimeoutMs !== void 0 ? { requestedTimeoutMs } : {}
             }));
           }, timeoutMs);
@@ -43890,9 +44558,9 @@ var FetchproxyServer = class {
     if (opts.subdomain !== void 0)
       assertSubdomainLabel(opts.subdomain);
     const baseDomain = this.resolveBaseDomain(opts.domain);
-    const isAbsolute3 = path.startsWith("http://") || path.startsWith("https://");
+    const isAbsolute4 = path.startsWith("http://") || path.startsWith("https://");
     let host;
-    if (isAbsolute3) {
+    if (isAbsolute4) {
       try {
         host = new URL(path).host;
       } catch {
@@ -43901,7 +44569,7 @@ var FetchproxyServer = class {
     } else {
       host = opts.subdomain ? `${opts.subdomain}.${baseDomain}` : baseDomain;
     }
-    const url2 = isAbsolute3 ? path : `https://${host}${path}`;
+    const url2 = isAbsolute4 ? path : `https://${host}${path}`;
     assertUrlInDomains("request url", url2, this.opts.domains);
     let tabUrl = `https://${host}/`;
     if (opts.viaTab !== void 0) {
@@ -44390,8 +45058,9 @@ var FetchproxyServer = class {
       this.pendingCapture,
       id,
       `https://${opts.host}${opts.path ?? "/*"}`,
-      // #277: not to extend the deadline — so a timeout can say the deadline,
-      // and not the value asked for here, is what fired.
+      // #237: this GOVERNS the deadline (window + reply grace, floored at the
+      // transport bound). Under #277 it did not, and was passed only so the
+      // timeout could name the number that actually fired.
       opts.timeoutMs
     );
   }
@@ -44483,8 +45152,9 @@ var FetchproxyServer = class {
       this.pendingRedirect,
       id,
       `https://${opts.host}${opts.path ?? "/*"}`,
-      // #277: not to extend the deadline — so a timeout can say the deadline,
-      // and not the value asked for here, is what fired.
+      // #237: this GOVERNS the deadline (window + reply grace, floored at the
+      // transport bound). Under #277 it did not, and was passed only so the
+      // timeout could name the number that actually fired.
       opts.timeoutMs
     );
   }
@@ -44573,10 +45243,11 @@ var FetchproxyServer = class {
       this.pendingDownload,
       id,
       opts.url,
-      // #277, same as the two capture verbs: `download` takes a per-call
-      // timeoutMs too, so it hits the identical cap and needs the identical
-      // explanation. Missing it was the point of #279 — "both verbs" was
-      // counted off the two call sites in view rather than off the type.
+      // `download` takes a per-call timeoutMs like the two capture verbs, so
+      // it is governed by it like them (#237). It used to hit the identical
+      // CAP and need the identical explanation; missing it then was the point
+      // of #279 — "both verbs" was counted off the two call sites in view
+      // rather than off the type. Three is still the number.
       opts.timeoutMs
     );
   }
@@ -44950,11 +45621,21 @@ var FetchproxyServer = class {
   /**
    * 2.5.0: the extension link as {@link BridgeSessionState}, read off
    * whichever handle is live. A pending pair code outranks "extension not
-   * seen" because the code could only have come from the extension — a
-   * peer behind an older host never sees the extension hello but does see
-   * pair-pending frames. Where the extension is KNOWN to be gone (a host's
+   * seen" because a code could only have come from a `pair-pending` frame
+   * the extension sent. Where the extension is KNOWN to be gone (a host's
    * socket closed, a peer told by a 2.5.0+ host) the handle has already
    * dropped the code, so the precedence never lies there (#283).
+   *
+   * M1 (bridge review 2026-09-10): a code is now only ever present when the
+   * handle DERIVED it from both identity pubs, and both handles set and clear
+   * that derivation in lockstep with the extension hello — so the precedence
+   * has nothing left to decide: a pair code implies the hello, which implies
+   * `extensionConnected`. A peer behind a pre-1.12.0 host is relayed no
+   * extension hello, cannot derive, and therefore reports
+   * `extension_disconnected` with a null code where it used to report the
+   * wire's number as `pair_pending` — the honest state for a peer that has
+   * never been told an extension is there. That is the trade: a number nobody
+   * can check is worse than no number.
    */
   sessionSnapshot() {
     const handle = this.hostHandle ?? this.peerHandle;
@@ -45004,6 +45685,7 @@ var FetchproxyServer = class {
 
 // node_modules/@fetchproxy/bootstrap/dist/index.js
 var defaultFactory = (opts) => new FetchproxyServer(opts);
+var CAPTURE_BOOTSTRAP_DEADLINE_MS = 45e3;
 async function bootstrap(opts) {
   return runOneLift(opts);
 }
@@ -45062,7 +45744,25 @@ async function runOneLift(opts) {
     onPairCode: opts.onPairCode,
     // 0.8.0+ pass-through. Only forwarded when the caller set them;
     // unset → server defaults apply (30000 / 2000 in 0.8.0).
-    ...opts.fetchTimeoutMs !== void 0 ? { fetchTimeoutMs: opts.fetchTimeoutMs } : {},
+    //
+    // EXCEPT when captures are declared and the caller named no deadline of
+    // their own, where the default is a tie this side loses. `bootstrap` asks
+    // for no per-call `timeoutMs` below, so the capture runs for the
+    // EXTENSION's 30 s default — against a transport deadline that is also
+    // 30 s. Two timers armed for the same instant, and this one starts first,
+    // because its frame has yet to travel.
+    //
+    // The timing was never the problem; the MESSAGE was. Winning that race
+    // replaces the extension's rejection — which explains that a capture
+    // resolves on the next request the PAGE makes, so an idle tab times out —
+    // with a bare `did not respond within 30000ms`, naming a number the caller
+    // never chose about a mechanism it never mentions. Twelve MCPs reach
+    // captures only through here, so they all inherited it.
+    //
+    // Only when the caller set nothing: an explicit `fetchTimeoutMs` is a
+    // deliberate bound and stays exactly as given, even though it re-loses the
+    // race. Bounding is theirs to decide; this only fills a default.
+    ...opts.fetchTimeoutMs !== void 0 ? { fetchTimeoutMs: opts.fetchTimeoutMs } : opts.declare.captureHeaders.length > 0 ? { fetchTimeoutMs: CAPTURE_BOOTSTRAP_DEADLINE_MS } : {},
     ...opts.bridgeReviveDelayMs !== void 0 ? { bridgeReviveDelayMs: opts.bridgeReviveDelayMs } : {}
   });
   const storageDomainOpts = {};
@@ -45388,7 +46088,7 @@ async function loginWithPassword(username, password) {
 // package.json
 var package_default = {
   name: "ofw-mcp",
-  version: "2.16.2",
+  version: "2.16.3",
   license: "MIT",
   mcpName: "io.github.chrischall/ofw-mcp",
   description: "OurFamilyWizard MCP server for Claude \u2014 developed and maintained by AI (Claude Code)",
@@ -45423,7 +46123,7 @@ var package_default = {
   },
   dependencies: {
     "@chrischall/mcp-utils": "^0.27.1",
-    "@fetchproxy/bootstrap": "^2.2.0",
+    "@fetchproxy/bootstrap": "^3.0.1",
     "@modelcontextprotocol/sdk": "^1.30.0",
     dotenv: "^17.4.2",
     zod: "^4.5.4"
@@ -50374,7 +51074,7 @@ var nodeCacheProvider = () => nodeCache ??= OFWCache.open(getCacheDbPath());
 var nodeAttachmentIO = new NodeAttachmentIO();
 await runMcp({
   name: "ofw",
-  version: "2.16.2",
+  version: "2.16.3",
   // x-release-please-version
   deps: client,
   tools: [